Cloud administration tools, as well as cloud-based intrusion detection systems, typically depend on the ability to gain formal understanding of very complex network traffic. Different cloud environments can substantially differ depending on the particular software environment, geographic zone, distribution of user activities and services, etc. Analyzing network traffic and gaining a higher-level view of network traffic in a cloud can thus become prohibitive if it depends on an exact knowledge of technical details of each particular software protocol, service, or tool in use in such a cloud. Complete technical knowledge about the cloud environment is difficult to obtain in full, especially as cloud is quickly evolving.